First Flip
100
Change the top-1 ImageNet label while staying close to the starter image.
- L∞
- ≤ 42
- MSE
- ≤ 160
JPEG Survivor
175
The label must still flip after the server re-encodes your image as JPEG quality 65.
- L∞
- ≤ 58
- MSE
- ≤ 260
- JPEG
- Q65
Top-5 Ghost
250
Push the original class out of the model's top-5 predictions.
- L∞
- ≤ 80
- MSE
- ≤ 520
Bad Sticker
225
Patch-style attack: change at most 12% of pixels and flip the top-1 label.
- Changed
- ≤ 12%
